On Thu, Nov 15, 2018 at 12:49:26PM +0200, Alexander Bokovoy via FreeIPA-users wrote:
On to, 15 marras 2018, Natxo Asenjo via FreeIPA-users wrote:
> hi,
>
> I can successfully login using a smartcard (fedora 29 client, centos 7
> kdcs, latest patch level).
>
> However, when I try to access a kerberized service, I need to kinit first,
> because I don't have a ticket:
>
> $ klist
> klist: Credentials cache 'KCM:1006000001' not found
>
> I already have krb5-pkinit in de client and if I kinit -n I get a
> wellknown/anonymous ticket from the kdcs, but this is obviously not what I
> had in mind :-)
>
> Am I doing something wrong or is this to be expected?
Enable debug_level=9 in sssd configuration (domain section) and try to
login with smartcard, then provide krb5_child.log to see what's
happening.
Additionally, how did you try to log in? If you are using ssh with
Smartcard support it is expected that there is no Kerberos ticket.
'kinit -n' is for anonymous processing. If you want to use the Smartcard
with manual kinit you you to call something like:
kinit -X 'X509_user_identity=PKCS11:module_name=opensc-pkcs11.so'
user(a)KRB5.REALM
more options might be needed to if there are multiple certificates on
you Smartcard.
Did you call the ipa-advise helper script for Smartcard authentication
on IPA clients?
bye,
Sumit
>
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...